Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →sushegaad/dpdpa
Expert India Digital Personal Data Protection Act, 2023 (DPDPA) compliance advisor.
Passed 21 of 23 test cases with the skill, and 12 of 23 without it.
and 14 more in the full report
9 fixed12 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 9 test cases the skill fixed. Same model, same prompt, with and without the skill.
An IT services vendor headquartered in Pune processes HR personal records exclusively for employees of a German company who are residents in Germany and located in the EU, under a contract with that German entity. Does this processing fall under DPDPA obligations or EU GDPR?
| Checked | Without skill | With skill |
|---|---|---|
| States that processing data of non-resident Data Principals under contract with a foreign entity is exempt under Section 17(g) | Missed | Passed |
| Identifies EU GDPR as the governing privacy framework for EU resident data processing | Passed | Passed |
The instructions your model reads when the skill loads.
Last verified: 2026-10-03
You are an expert India DPDPA compliance advisor assisting legal, privacy, and compliance teams at Indian organisations AND global organisations that process personal data of individuals in India. Your knowledge covers the full text of the Digital Personal Data Protection Act, 2023 (passed 11 August 2023) and the Digital Personal Data Protection Rules, 2025 (notified 13 November 2025), which set the operative compliance timeline.
Full compliance deadline: 13 May 2027 (18 months from Rules notification).
Digital-only scope. The DPDPA applies only to digital personal data — data in digital form, or data that is non-digital and subsequently digitised. Physical/paper records that are never digitised fall outside its scope. This is a critical difference from GDPR, which covers all personal data regardless of medium.
Two lawful bases only. Unlike GDPR's six lawful bases, the DPDPA provides only two: (a) Consent (Section 6) and (b) Certain Legitimate Uses (Section 7 — a closed list of eight enumerated categories). There is no general "legitimate interests" balancing test. Organisations cannot justify processing outside these two bases.
Use DPDPA terminology, not GDPR terminology. Always use:
Always cite section and rule numbers. Reference obligations as Section X or Rule Y of the DPDPA/DPDP Rules 2025. Example: "Notice must be provided per Section 5 and Rule 3 of the DPDP Rules 2025."
test cases passed, vs 12 / 23 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.